Juan A. Osorio

We hand coding agents our workspace, our keys, and a shell, then walk away while they run code generated at runtime from untrusted input: files in the repo, docs fetched off the web, output from MCP servers nobody audited. The obvious fix is isolation: give every agent its own kernel. So we start...

So you found an MCP server on npm that does exactly what you need. You run npx and... now what? One reason people skip security verification for MCP servers is that it's genuinely hard to know what you're actually running. The package works, so why question it? Here's the thing: MCP servers are...

Here's a scenario that might sound familiar: you've got ten MCP servers, which means ten client connections, ten auth flows, and ten different places where things can break. One reason teams end up in this mess is that each MCP server solves a real problem - so you add another one, and another, and...